Malware Blocking and Dependency Policies in Composer 2.10

Composer 2.10 is now available with native malware filtering, a new dependency policy configuration system, and several security-related changes for PHP projects.

The release was announced by Stephan Vock and Nils Adermann on the Packagist blog, and the big feature is a malware policy that blocks package versions flagged as malicious from being installed through Packagist.org.

Composer 2.10 introduces a malware policy to enable rapid removal of malicious versions published either by attackers who briefly gained control of a legitimate package, or by maintainers acting in bad faith. Flagged versions are removed from the resolution pool, so they cannot be installed via composer update, composer require or composer create-project. Crucially, the check also runs during composer install where versions flagged after a composer.lock was generated will fail the next install. A malicious release that slipped into a lockfile will not be silently pulled in on CI runs or in production deployments. The same versions are surfaced by composer audit, which fails the audit when finding malware by default.

Composer already blocks package versions with known security advisories during updates. Composer 2.10 expands that protection to malware, including package versions published after an attacker gains control of a repository or package.

Other Composer 2.10 highlights include:

• A new config.policy object for security advisories, abandoned packages, malware, and custom policies.
• Deprecation of automatic source fallback when dist downloads fail, with a temporary source-fallback config option.
• Wildcard support for composer update --with, for example composer update --with "acme/*:^2.0".
• A new --require option for composer create-project.
• Plugin autoloading and dependency resolver memory improvements.

Composer's changelog marks two backward-compatibility items in 2.10: automatic source fallback is disabled, and composer audit exit codes now use 0 for success and 1 when the audit fails.

You can update Composer with the self-update command:

composer self-update

Read the full Composer 2.10 release announcement on the Packagist blog for the full security context, default policy behavior, configuration examples, and links to the related implementation PRs. Also, if you release packages be sure and check out their other post on An Update on Composer & Packagist Supply Chain Security.